---
title: "migrate secrets from Azure Key Vault to database"
method: POST
path: "/settings/migrate_secrets_from_azure_kv"
tags: ["setting"]
---

# migrate secrets from Azure Key Vault to database

`POST /settings/migrate_secrets_from_azure_kv`

## Request body

- AzureKeyVaultSettings
  - `vault_url` string, required — Azure Key Vault URL (e.g., https://myvault.vault.azure.net)
  - `tenant_id` string, required — Azure AD tenant ID
  - `client_id` string, required — Azure AD application (client) ID
  - `client_secret` string — Azure AD client secret. Optional — when omitted, the integration falls back to Azure Workload Identity Federation, exchanging the Kubernetes-projected service-account JWT at AZURE_FEDERATED_TOKEN_FILE for an access token (no long-lived secret stored).
  - `token` string — Static Bearer token for testing/development (optional, if provided this is used instead of OAuth2 authentication)

## Response `200`

migration report

- SecretMigrationReport
  - `total_secrets` integer, required — Total number of secrets found
  - `migrated_count` integer, required — Number of secrets successfully migrated
  - `failed_count` integer, required — Number of secrets that failed to migrate
  - `failures` SecretMigrationFailure[], required — Details of any failures encountered during migration
    - `workspace_id` string, required — Workspace ID where the secret is located
    - `path` string, required — Path of the secret that failed to migrate
    - `error` string, required — Error message

---

[API](https://skmtc.net/windmill/apis/windmill-api.md) · [All operations](https://skmtc.net/windmill/apis/windmill-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/windmill/windmill-api/revisions/db0e7e036e34/schema)